Store token files with `0600` permissions

Problem

Beets stores authentication/token files that may contain sensitive credentials. These files should not be readable or writable by other users on the system.

Currently, token files may be created using the default filesystem permissions, which can result in permissions that are more permissive than intended depending on the user's umask.

Expected behavior

Token files should always be created with permissions:

0600

This means:

• Owner: read + write
• Group: no access
• Others: no access

The implementation should explicitly set the file mode rather than relying solely on the process umask.

Proposed solution

When creating or writing token files, ensure they are created with 0600 permissions. Ideally, the file should be created atomically with the desired mode to avoid a window where the file has broader permissions.

For existing token files, consider restricting their permissions to 0600 when they are accessed or updated.